Chainlit MCP flaw lets attackers run code with no login

A GitHub advisory discloses unauthenticated remote code execution in Chainlit's MCP endpoint, tracked as CVE-2026-45018. The GitHub advisory, rated critical and published August 25, covers Chainlit versions 2.4.0rc0 through 2.11.x.

No login is required to trigger it. The only thing limiting exposure is that MCP has shipped disabled by default since Chainlit v2.7.0. The bug only bites deployments that turned the feature on.

The bug sits in validate_mcp_command(). When a deployment enables features.mcp.enabled, POST /mcp accepts a user-controlled fullCommand for stdio-based tool connections. The function checks that command against an allowlist of executable names, but it doesn't inspect the arguments. Send npx -y -c '<command>' and the executable name passes the check, while -c hands arbitrary code to the server process.

A second flaw in the same endpoint, CVE-2026-45019, rates high severity. Its sse and streamable-http transports accept an arbitrary url parameter. They also pass through attacker-controlled Authorization and Cookie headers, turning the endpoint into a server-side request forgery tool against internal services.

Anyone who explicitly turned the feature on, in any version from 2.4.0rc0 through 2.11.x, is exposed until they patch to 2.12.0 or disable it.